- Fix import paths in electron/plugin-node-executor.ts
- Fix import paths in electron/preload.ts
- Change from dist/types to src/types for plugin-api imports
- Remove unnecessary PLUGIN_REGISTER_FOR_NODE/PLUGIN_UNREGISTER_FOR_NODE
- Eliminate tmp directory usage - scripts execute via -e flag directly
- Pass manifest with each execution request instead of registration
- Simplify from 535 lines to 227 lines (57% reduction)
- Remove complex execution contexts and resource tracking
- Direct VM execution for safe scripts, spawn with -e for complex ones
Benefits:
- No more temp file management overhead
- No registration/unregistration complexity
- Permissions checked on each execution (fail-safe)
- Much simpler to understand and maintain
- Same security model, less code
- Add 'Sync Now' button to UI for manual triggering
- Perform initial sync when plugin loads with valid config
- Add debug logging for task update hooks
- Add syncNow message handler for bidirectional sync support
- This helps test sync functionality and ensures initial data is written
- Add canExecuteDirectly() to check if script only uses safe fs operations
- Add executeDirectly() to run simple scripts in VM sandbox without spawning
- Set ELECTRON_RUN_AS_NODE environment variable for spawn fallback
- Improve error handling for missing node executable
- Fix linting issues by using proper imports
- This fixes 'spawn node ENOENT' errors when Node.js is not in PATH
- Create window-ea.d.ts to properly type window.ea (ElectronAPI)
- Replace all 'as any' castings with proper types
- Update all any[] to unknown[] for better type safety
- Import proper types (PluginManifest) in electron files
- Update plugin-api types to use unknown instead of any
- Fix app.getPath type casting with proper parameter types
- Rebuild plugin-api dist files with updated types
- Implement secure Node.js script executor in Electron main process
- Add sandboxed execution environment with memory/timeout limits
- Create two-stage consent dialog for nodeExecution permission
- Add plugin registration/unregistration with main process
- Integrate executeNodeScript method into plugin API
- Add IPC handlers for plugin-to-main communication
- Ensure consent is checked when enabling plugins
- Add proper cleanup on plugin unload
Security features:
- Dangerous globals removed from execution context
- Plugin-specific working directories
- Configurable memory and timeout limits
- Persistent consent storage
- Only available in Electron environment
